fix(fork): merge upstream 5211acf into patch/timeline-index-reuse

.agents/skills/test-t3-app/SKILL.md

@@ -21,6 +21,19 @@ Test with meaningful project and thread data. Read
 [references/sqlite-fixtures.md](references/sqlite-fixtures.md) only when
 inspecting or seeding SQLite. Stop the test server before direct fixture writes.
 
+## Drive agent turns for free
+
+Do not spend a paid model to see a turn render. `vp run dev` registers the
+`Replay (dev)` provider, which replays recorded turns with simulated streaming
+through the real adapter and orchestration. Its models are scenarios:
+`showcase` covers thinking, a plan, tool calls, an approval, and markdown.
+Press `Ctrl+Alt+Shift+R` for a picker (GNOME takes that key for screen
+recording), call `window.t3dev.replay("showcase")`
+with `preview_evaluate`, or run
+`node apps/server/src/bin.ts thread start --base-dir .t3 --provider devReplay --model showcase <project> "go"`.
+When the test needs real provider behavior, use that provider's cheapest
+model, such as Haiku for Claude or Luna for Codex.
+
 ## Use the Browser panel
 
 Call `preview_status`, then `preview_open` if the Browser panel is

.coderabbit.config.ts

@@ -26,13 +26,19 @@ export default defineConfig((ctx) => ({
         path: "apps/web/src/**/*.{tsx,css}",
         instructions: "Hold changed code to the rules in docs/internals/web-ui.md.",
       },
+      {
+        path: "**/*.test.*",
+        instructions:
+          "Hold changed tests to the rules in docs/internals/testing.md. Request tests only as those rules allow.",
+      },
     ],
   },
   knowledge_base: {
     code_guidelines: {
       filePatterns: [
         { files: "docs/internals/effect-services.md", applyTo: "{apps,packages,infra}/**/*.ts" },
         { files: "docs/internals/web-ui.md", applyTo: "apps/web/src/**/*.{tsx,css}" },
+        { files: "docs/internals/testing.md", applyTo: "{apps,packages,infra}/**/*.{ts,tsx}" },
       ],
     },
   },

.github/actions/setup-ci-deps/action.yml

@@ -5,6 +5,14 @@ inputs:
     description: Read-only credential for the private maintainer task cache
     required: false
     default: ""
+  install:
+    description: Set to "false" to set up Vite+ only, with no pnpm store or install
+    required: false
+    default: "true"
+  install-args:
+    description: Arguments for `vp install`, such as filters. Empty installs the whole workspace.
+    required: false
+    default: ""
 runs:
   using: composite
   steps:
@@ -19,10 +27,11 @@ runs:
         echo "node=$(jq -r '.engines.node' package.json)" >> "$GITHUB_OUTPUT"
         echo "pnpm=$(jq -r '.packageManager' package.json)" >> "$GITHUB_OUTPUT"
 
+    # Pinned because release-desktop.yml signs builds with this action in the job.
     - name: Cache Vite+
       id: vp_cache
       if: steps.vp.outputs.version != ''
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: ~/.vite-plus
         key: vite-plus-home-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}-node${{ steps.vp.outputs.node }}-${{ steps.vp.outputs.pnpm }}
@@ -38,38 +47,93 @@ runs:
         echo "$HOME/.vite-plus/bin" >> "$GITHUB_PATH"
         "$HOME/.vite-plus/bin/vp" env use "${{ steps.vp.outputs.node }}"
 
+    # vp gives each Node.js download attempt 10 minutes by default, so one
+    # stalled stream holds the job that long. It retries 3 times and resumes
+    # partial bytes, so a shorter limit costs a slow download only a retry.
     - name: Setup Vite+
       if: steps.vp_cache.outputs.cache-hit != 'true'
-      uses: voidzero-dev/setup-vp@v1
+      uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
+      env:
+        VP_DOWNLOAD_TIMEOUT: "120"
       with:
         node-version-file: package.json
         cache: false
         run-install: false
 
-    - name: Resolve pnpm store path
+    # A shared key lets whichever install saves first, often a small filtered
+    # one, become every job's store. Each set of install args gets its own.
+    - name: Resolve pnpm store
       id: pnpm_store
+      if: inputs.install == 'true'
       shell: bash
+      env:
+        INSTALL_ARGS: ${{ inputs.install-args }}
       run: |
-        store_path="$(vp pm cache dir)"
-        echo "path=$store_path" >> "$GITHUB_OUTPUT"
+        echo "path=$(vp pm cache dir)" >> "$GITHUB_OUTPUT"
+        metadata_dir="${pnpm_config_cache_dir:-$RUNNER_TEMP/pnpm-metadata}"
+        echo "pnpm_config_cache_dir=$metadata_dir" >> "$GITHUB_ENV"
+        echo "verified=$metadata_dir/lockfile-verified.jsonl" >> "$GITHUB_OUTPUT"
+        if [[ -z "$INSTALL_ARGS" ]]; then
+          echo "namespace=full" >> "$GITHUB_OUTPUT"
+        else
+          echo "namespace=filtered-$(printf '%s' "$INSTALL_ARGS" | cksum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+        fi
 
-    # setup-vp's shared cache key ignores install filters. Keep full installs in a
-    # separate namespace, including fallback restores.
+    # Filtered installs prefer the current full store, which holds every package,
+    # over an older store of their own.
     # The pnpm store stays a cache tarball on the runner's own disk. A store on a
     # Blacksmith sticky disk mounts in under a second, but pnpm then copies every
     # package across filesystems instead of hard-linking it: install took 28-49s
     # against 9s plus an 11s restore.
-    - name: Cache full pnpm store
-      uses: actions/cache@v6
+    - name: Restore pnpm store
+      id: pnpm_cache
+      if: inputs.install == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: ${{ steps.pnpm_store.outputs.path }}
-        key: pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+        key: pnpm-${{ steps.pnpm_store.outputs.namespace }}-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
         restore-keys: |
+          pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+          pnpm-${{ steps.pnpm_store.outputs.namespace }}-v1-${{ runner.os }}-${{ runner.arch }}-
           pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-
 
+    # pnpm accepts an earlier pass for the same lockfile and policy at any age, so
+    # a cached record skips fetching registry metadata for every package.
+    - name: Restore lockfile verification
+      id: pnpm_verified
+      if: inputs.install == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.verified }}
+        key: pnpm-verified-v1-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+
     - name: Install dependencies
+      if: inputs.install == 'true'
       shell: bash
-      run: vp install
+      env:
+        INSTALL_ARGS: ${{ inputs.install-args }}
+      # Unquoted so each filter is its own argument.
+      run: vp install $INSTALL_ARGS
+
+    - name: Save lockfile verification
+      if: inputs.install == 'true' && steps.pnpm_verified.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.verified }}
+        key: ${{ steps.pnpm_verified.outputs.cache-primary-key }}
+
+    # A filtered install that started from the current full store adds nothing
+    # worth a second copy of it.
+    - name: Save pnpm store
+      if: >-
+        inputs.install == 'true' &&
+        steps.pnpm_cache.outputs.cache-hit != 'true' &&
+        (steps.pnpm_store.outputs.namespace == 'full' ||
+          steps.pnpm_cache.outputs.cache-matched-key != format('pnpm-full-v1-{0}-{1}-{2}', runner.os, runner.arch, hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json')))
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.path }}
+        key: ${{ steps.pnpm_cache.outputs.cache-primary-key }}
 
     - name: Enable shared task cache
       if: >-

.github/triage/PLAYBOOK.md

@@ -11,8 +11,8 @@ provided alongside this playbook. Everything machine-specific lives there, not h
 
 ## 1. Ask what went wrong
 
-Your first message to the user: ask them to describe what went wrong, in their own
-words. Ask them to paste screenshots directly into this session if they have any.
+Unless the user already described it, your first message asks what went wrong, in
+their own words. Ask them to paste screenshots directly into this session if they have any.
 Ask follow-up questions when the description is vague. Good repro steps are the most
 valuable thing you can extract from this conversation.
 

.github/workflows/agent-context-budget.yml

@@ -0,0 +1,55 @@
+name: Agent Context Budget
+
+# Fails when a PR raises a value in agentContextBudget.json above main's. AgentContextBudget.test.ts
+# keeps that file equal to the measured context, so the context cannot grow by editing the file.
+# To accept growth on purpose, a maintainer adds the agent-context-increase label.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agent-context-budget-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  budget:
+    name: Agent context budget
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    env:
+      BUDGET: apps/server/src/provider/agentContextBudget.json
+      ALLOW_INCREASE: ${{ contains(github.event.pull_request.labels.*.name, 'agent-context-increase') }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: apps/server/src/provider/agentContextBudget.json
+          sparse-checkout-cone-mode: false
+
+      - name: Compare with main
+        run: |
+          git fetch --quiet --depth=1 origin main
+          if ! git cat-file -e "FETCH_HEAD:$BUDGET" 2>/dev/null; then
+            echo "main has no agent context budget yet."
+            exit 0
+          fi
+          git show "FETCH_HEAD:$BUDGET" > "$RUNNER_TEMP/main.json"
+          grown=$(jq -r --slurpfile main "$RUNNER_TEMP/main.json" '
+            to_entries[]
+            | select($main[0][.key] != null and .value > $main[0][.key])
+            | "\(.key): \($main[0][.key]) -> \(.value) (+\(.value - $main[0][.key]))"
+          ' "$BUDGET")
+          if [ -z "$grown" ]; then
+            echo "Agent context is not larger than main."
+            exit 0
+          fi
+          printf 'Agent context grew compared to main:\n%s\n' "$grown"
+          if [ "$ALLOW_INCREASE" = "true" ]; then
+            echo "Accepted by the agent-context-increase label."
+            exit 0
+          fi
+          echo "::error file=$BUDGET::Agent context grew compared to main. Cut the added text, or ask a maintainer to add the agent-context-increase label."
+          exit 1

.github/workflows/ci.yml

@@ -225,16 +225,6 @@ jobs:
             !/apps/mobile/modules/t3-terminal/Vendor/**/*.a
           sparse-checkout-cone-mode: false
 
-      # Blacksmith boots GitHub's Ubuntu runner image (gcc is usually present),
-      # but ACP process-tree live tests compile a small pthread fixture with `cc`
-      # and soft-skip when it is missing. Install build-essential so that path
-      # always runs in CI instead of silently no-oping.
-      - name: Install C toolchain for process-tree fixtures
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends build-essential
-          command -v cc
-
       - uses: ./.github/actions/setup-apt-mirrors
 
       # The desktop tests compile the browser secret helper. The install runs in
@@ -344,6 +334,12 @@ jobs:
       - name: Test
         run: vp run --filter @t3tools/web test
 
+      # Browser tests run source modules; this boots the production chunk graph.
+      - name: Boot the built web client
+        run: |
+          vp run --filter @t3tools/web build
+          node apps/web/scripts/verify-built-boot.ts
+
   # apps/server sets `fileParallelism: false`, so its test files run strictly
   # one at a time. Sharding spreads them over separate runners instead of
   # separate workers, so no two server test files ever share a machine and the
@@ -358,7 +354,9 @@ jobs:
       id-token: write
     name: Test Server ${{ matrix.shard }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
-    timeout-minutes: 10
+    # Shards take 2-5 minutes. When the shared task cache throttles reads, each
+    # failed fetch stalls vp for 15-90s, which pushed shards past 10 minutes.
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:

.github/workflows/deploy-relay.yml

@@ -5,12 +5,11 @@ on:
     branches:
       - main
   # Redeploys main after a variable or secret change. Alchemy redeploys the
-  # Worker when a value it reads changes, so force is rarely needed, and it
-  # replaces the Postgres runtime role (alchemy-run/alchemy#1832).
+  # Worker when a value it reads changes, so force is rarely needed.
   workflow_dispatch:
     inputs:
       force:
-        description: Redeploy every resource, including ones with no detected changes. Replaces the Postgres runtime role.
+        description: Redeploy every resource, including ones with no detected changes.
         type: boolean
         default: false
 
@@ -81,6 +80,7 @@ jobs:
           CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
           APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }}
           FCM_SERVICE_ACCOUNT: ${{ secrets.FCM_SERVICE_ACCOUNT }}
+          T3CHAT_LINK_SECRET: ${{ secrets.T3CHAT_LINK_SECRET }}
 
       - name: Publish relay deploy commit status
         uses: actions/github-script@v8

.github/workflows/mobile-eas-production.yml

@@ -275,6 +275,7 @@ jobs:
             --environment production \
             --platform ${{ inputs.platform }} \
             --message "$OTA_MESSAGE" \
+            --emit-metadata \
             --non-interactive
 
       # Reconcile each version separately because the major is in the fingerprint.
@@ -313,8 +314,11 @@ jobs:
                 --environment production \
                 --platform "$platform" \
                 --message "$message" \
+                --emit-metadata \
                 --non-interactive; then
                 echo ":white_check_mark: $platform/$profile: OTA published to production (fingerprint \`$hash\`)" >> "$GITHUB_STEP_SUMMARY"
+                # The next target's export replaces dist; keep this one for the map upload.
+                rm -rf "dist-$platform-$profile" && mv dist "dist-$platform-$profile"
               else
                 failed=1
                 echo ":x: $platform/$profile: OTA publish failed (fingerprint \`$hash\`)" >> "$GITHUB_STEP_SUMMARY"
@@ -354,3 +358,18 @@ jobs:
             fi
           done
           exit "$failed"
+
+      # Lets the relay symbolicate crash stacks from the updates published
+      # above. A step of its own so the R2 credentials reach only this script,
+      # not `eas update` and the dependencies it runs. Never fails the job.
+      - name: Upload OTA source maps
+        if: ${{ !cancelled() && steps.expo-token.outputs.present == 'true' }}
+        working-directory: apps/mobile
+        env:
+          MOBILE_SOURCEMAPS_R2: ${{ secrets.MOBILE_SOURCEMAPS_R2 }}
+        run: |
+          for dir in dist dist-*; do
+            if [ -f "$dir/eas-update-metadata.json" ]; then
+              node scripts/upload-sourcemaps.mts ota "$dir"
+            fi
+          done

.github/workflows/relay-preview.yml

@@ -79,3 +79,5 @@ jobs:
           PLANETSCALE_API_TOKEN: ${{ secrets.PLANETSCALE_API_TOKEN }}
           AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
           CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
+          # Unset by default, so previews keep the T3 Chat link off.
+          T3CHAT_LINK_SECRET: ${{ secrets.T3CHAT_LINK_SECRET }}